CVE-2026-84834
CriticalCVSS 9.8Summary
Unauthenticated PHP Object Injection vulnerability in JobSearch versions up to 3.2.0. An attacker can inject malicious PHP objects, potentially leading to arbitrary code execution.
Risk Assessment
An unauthenticated attacker could exploit this to execute arbitrary code on the server, potentially compromising the website and its data.
Recommendation
Immediately update the JobSearch plugin to the latest patched version.
Other vulnerabilities in JobSearch
See all- CVE-2026-54186Critical
In JobSearch versions up to 3.2.9, there is an unauthenticated SQL Injection vulnerability that can be exploited by an attacker to execute unauthorized queries against the database.
- CVE-2026-57383High
The JobSearch WordPress plugin (versions up to 3.2.9) contains a stored XSS vulnerability. Improper input neutralization during web page generation allows an attacker to inject a malicious script.
- CVE-2026-49057High
JobSearch versions up to 3.2.7 contain a vulnerability in access control that allows unauthorized access to resources.
Original NVD description (English source)
Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions.